server validation goes on whichever page the form posts to.
it can post to itself, this is the easiest, or you can set it to post to another page, either way, all form processing happens on the forms action page, including validation.
see the double opt in tutorial for your second question:
http://www.webassist.com/tutorials/Double-opt-in-registration